Virus.DOS.1stVir is a memory resident parasitic virus on DOS.

There are 2 variants:

  • Virus.DOS.1stVir.3032
  • Virus.DOS.1stVir.3173


When the virus is run, it hooks 1Ch, 21h, and 28h to infect any executable that is run by writing itself to the end of the file. The infection size varies in different files.

When the file is executed, the virus stores its name, and infects that file on INT 1Ch or INT 28h calls. So the virus infects the file not at the same moment when the file is executed, but with some delay.

Memory usage

The following table shows the memory usage of the variants.

Variant Memory usage in bytes
1stVir.3032 4,096
1stVir.3173 4,096


The virus hooks INT 9 and 13h for activation. When activated the virus changes the video mode, pages, cursor and mouse position, and displays the string "1st".

Other details

The virus contains the encrypted text strings: